Beispiel #1
0
    def __can_be_part_of_assert(cfunc, ctree_item):
        # type: (idaapi.cfunc_t, idaapi.ctree_item_t) -> bool
        """
        Returns true if expression we clicked is an argument passed to a function
        and this argument is a string that can be a valid function name
        """

        if ctree_item.citype != idaapi.VDI_EXPR:
            return False

        expression = ctree_item.it.to_specific_type
        if expression.op != idaapi.cot_obj:
            return False

        parent = cfunc.body.find_parent_of(expression).to_specific_type
        if parent.op != idaapi.cot_call or parent.x.op != idaapi.cot_obj:
            return False

        obj_ea = expression.obj_ea
        if not helper.is_code_ea(obj_ea) and idc.get_str_type(
                obj_ea) == idc.STRTYPE_C:
            str_potential_name = idc.get_strlit_contents(obj_ea)
            if type(str_potential_name) is not str:
                # convert bytes to str (python 3)
                str_potential_name = str_potential_name.decode('ascii')
            return idaapi.is_valid_typename(str_potential_name)
        return False
Beispiel #2
0
def parse_vtable_name(address):
    name = idaapi.get_short_name(address)
    if idaapi.is_valid_typename(name):
        if name[0:3] == 'off':
            # off_XXXXXXXX case
            return "Vtable" + name[3:], False
    else:
        # Attempt to make nice and valid name from demangled RTTI name
        try:
            name = re.sub("^const ", "", name)
            sliced_names = name.split("::")
            name, for_part = "_for_".join(sliced_names[:-1]), sliced_names[-1]
            print name, for_part
            templates = re.search("<(.*)>", name)
            if templates:
                templates = templates.group(1)
                name = re.sub("<.*>", "", name)
                templates = re.sub("[^a-zA-Z0-9_*]", "_", templates)
                templates = re.sub("\*", "PTR", templates)
                name += '_' + templates

            for_part = re.search("\{for `(.*)'\}", for_part)
            if for_part:
                for_part = for_part.group(1)
                name += '_' + for_part

            return 'Vtable_' + name, True

        except (AttributeError, IndexError):
            print "[Warning] Unable to parse virtual table name - "

        return "Vtable_{0:X}".format(address), False
Beispiel #3
0
    def __add_func_name(self, arg_expr):
        new_name = idc.get_strlit_contents(arg_expr.obj_ea)
        if not idaapi.is_valid_typename(new_name):
            logger.warn("Argument has a weird name `{}` at {}".format(
                new_name,
                helper.to_hex(helper.find_asm_address(arg_expr,
                                                      self.parents))))
            return

        self.__possible_names.add(new_name)
Beispiel #4
0
    def __add_func_name(self, arg_expr):
        new_name = idc.get_strlit_contents(arg_expr.obj_ea)
        if type(new_name) is not str:
            # convert bytes to str (python 3)
            new_name = new_name.decode('ascii')
        if not idaapi.is_valid_typename(new_name):
            logger.warn("Argument has a weird name `{}` at {}".format(
                new_name,
                helper.to_hex(helper.find_asm_address(arg_expr,
                                                      self.parents))))
            return

        self.__possible_names.add(new_name)
Beispiel #5
0
def parse_vtable_name(address):
    name = idaapi.get_name(address)
    if idaapi.is_valid_typename(name):
        if name[0:3] == 'off':
            # off_XXXXXXXX case
            return "Vtable" + name[3:], False
        elif "table" in name:
            return name, True
        print "[Warning] Weird virtual table name -", name
        return "Vtable_" + name, False
    name = idc.demangle_name(idaapi.get_name(address), idc.INF_SHORT_DN)
    assert name, "Virtual table must have either legal c-type name or mangled name"
    return common.demangled_name_to_c_str(name), True
Beispiel #6
0
def parse_vtable_name(address):
    name = idaapi.get_name(address)
    if idaapi.is_valid_typename(name):
        if name[0:3] == 'off':
            # off_XXXXXXXX case
            return "Vtable" + name[3:], False
        elif "table" in name:
            return name, True
        print("[Warning] Weird virtual table name -", name)
        return "Vtable_" + name, False
    name = idc.demangle_name(idaapi.get_name(address),
                             idc.get_inf_attr(idc.INF_SHORT_DN))
    assert name, "Virtual table must have either legal c-type name or mangled name"
    return demangled_name_to_c_str(name).replace("const_", "").replace(
        "::_vftable", "_vtbl"), True
Beispiel #7
0
 def name(self):
     name = idaapi.get_name(self.address)
     if idaapi.is_valid_typename(name):
         return name
     name = idc.demangle_name(name, idc.get_inf_attr(idc.INF_SHORT_DN))
     return common.demangled_name_to_c_str(name)